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(57) A method for enabling privacy and trust in elec- 
tronic communities is disclosed. A major impediment to 
using recommendation systems and collective knowl- 
edge for electronic commerce is the reluctance of indi- 
viduals to reveal preferences in order to find groups of 
people that share them. An equally important barrier to 
fluid electronic commerce is the lack of agreed upon 
trusted third parties. We propose new non-third party 
mechanisms to overcome these barriers. Our solutions 
facilitate finding shared preferences, discovering com- 
munities with shred values, removing disincentives 
posed by liabilities, and negotiating on behalf of a group. 
We adapt known techniques from the cryptographic lit- 
erature to enable these new capabilities. 
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Description 

FIELD OF THE INVENTION 

5 [0001 ] The present invention relates to the field of electronic commerce, and in particular to a method for enabling 
privacy and trust in electronic communities. 

BACKGROUND OF THE INVENTION 

w [0002] With the advent of the World Wide Web and the ease of entry enabled by the Internet, electronic commerce 
is becoming an increasing reality, with a consequent growth in the number and variety of information providers and e- 
commerce sites. While this growth generates a diverse set of offerings from which consumers can only benefit, it also 
makes it hard for people to choose, in part because it is difficult to judge a priori the value of the offerings. In addition, 
since providers of electronic commerce sometimes lack recognizable reputations and can offer similar services, it is sel- 
ls dom possible to make optimal decisions as to which sites to access and which ones to avoid. As with many other situ- 
ations where choice is costly, people resort to a cooperative mechanism which relies on the collective search performed 
by a whole community to find desirable and useful sites. Large groups of people surfing and buying on their own can 
sample a much larger information space than single individuals, and any exchange of relevant findings can increase the 
awareness of possibly interesting sites. Even though recommendations, both personal and institutional, can be unreli- 
20 able and highly idiosyncratic, they decrease the cost of searching for optimal sources of information, while leading to 
the discovery of new sites and improved ways of surfing the Web. 

[0003] Given these considerations, one would expect to find within the Web sites and communities that issue useful 
recommendations on a number of topics. See W. C. Hill, L. Stead, M. Rosenstein and G. Furnas, .Recommending and 
evaluating choices in a virtual community of use", proc. CH 1*95, (1 995), 1 94-201 ; C. Avery and R. Zeckhauser, „Recom- 

25 mender systems for evaluating computer messages". Communications of the ACM 40, (1 997), 88-89; and N. Glance, 
D. Arregui, and M. Dardenne, ^Knowledge pump: supporting the flow and use of knowledge", in Information Technology 
for Knowledge Management. Eds. U. Borghoff and R. Pareschi, Springer (1998). This information can then be used to 
create recommendations for other users and to identify similar individuals, thereby helping to make informal communi- 
ties apparent. But while a great deal of economically useful information is distributed widely within groups of people 

30 such as large organizations, communities of practice (see B. A. Huberman and T Hogg, ^Communities of practice: per- 
formance and evolution", Computational and Mathematical Organization Theory 1, (1995), 73-92), scientific communi- 
ties and the economy at large, privacy issues make it hard to successfully exploit that knowledge. The limitations range 
from having to assess the quality of a recommendation from a group whose preferences might differ from the inquirer, 
to the natural reticence people have to reveal their preferences to an anonymous group with possibly different values. 

35 One issue that makes recommender systems perform below their potential is the difficulty of convincing potential 
advice-takers of the credibility and reliability of the recommendations. This depends in part on the willingness of poten- 
tial recommenders to make available the right information at the right times. An important factor that dissuades potential 
recommenders from participating effectively is the risk that failed advice could lead to bruised reputations and liabilities. 
R Samuelson, ^Liability for Defective Electronic Information", Communications of the ACM 36, (1993), 21-26. 

40 [0004] As in the physical world, there exist a number of useful mechanisms to circumvent problems of privacy, trust 
and liability. For example, a useful strategy for maintaining privacy consists in the anonymous posting of information. In 
recommender systems this can be useful when the recommendations are based on coarse characteristics such as the 
number of people voting for a particular choice. But anonymity has the drawback of preventing users from learning the 
usefulness of recommendations from particular people, track trends over time, and to use reputations which are built 

45 up over repeated interactions. The consistent use of pseudonyms can address some of these issues, but not all. One 
drawback of pseudonyms is that the very link which establishes reputation over time becomes a vulnerability if author- 
ship can be established by other means for any pseudonymous message. Issues of privacy can also be tackled by the 
use of trusted third parties to mediate the exchange of information. However, it can be difficult to get everyone in a com- 
munity to agree on a suitable third party, particularly when new users continually enter the system. Furthermore, the 

so collection of all information by a single third party can lead to a system-wide failure if such a party is compromised. What 
is truly desirable is the enhancement of privacy and trust in electronic communities without having to resort to anonym- 
ity, pseudonymity, or trusted third parties. 

SUMMARY OF THE INVENTION 

55 

[0005] A major impediment to using recommendation systems and collective knowledge for electronic commerce 
is the reluctance of individuals to reveal preferences in order to find groups of people that share them. An equally impor- 
tant barrier to fluid electronic commerce is the lack of agreed upon trusted third parties. A method for enabling privacy 
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and trust in electronic communities is disclosed to overcome these barriers by facilitating the processes of finding 
shared preferences, discovering communities with shared values, removing disincentives posed by liabilities, and nego- 
tiating on behalf of a group. 

[0006] An embodiment of the present invention provides a method for anonymously establishing a proving individ- 
s ual as a member for group, wherein the proving individual has a private key. An identification transcript is forged for least 
one unknown private key, wherein the transcript includes at least one forged commitment, at least one forged challenge, 
and at least one forged response. A valid commitment is calculated based on the proving individual's private key. The 
at least one forged commitment and a valid commitment are transmitted to a verifying individual. A verifying challenge 
is received from the verifying individual and a valid challenge is calculated based on the at least one challenge and the 
io verifying challenge. A valid response is calculated based on the valid challenge in the valid commitment. The at least 
one forge challenge, the valid challenge, the at least one forged response, and the valid response are transmitted to the 
verifying individual. The identification transcript may comprise a commitment, a challenge, and a response from a 
Schnorr identification protocol. The method may also include the step of verifying that the forged challenge and the valid 
challenge are consistent with the verifying challenge. The method may also include the step of verifying to the forged 
is response is consistent with a forged commitment and a forge challenge, and the step of verifying that the valid response 
is consistent with the valid commitment and in the valid challenge. 

[0007] Another embodiment of the present invention provides a method for a signing individual to deniably sign a 
document intended for a recipient, wherein the signing individual as a private key and public key and the recipient has 
a public key. An identification transcript is forged for an unknown private key, wherein the transcript comprises a forged 

20 commitment, a forged challenge, and a forged response. A random factor is calculated and a valid commitment is cal- 
culated based on the random factor. A for a fine challenge is calculated as a cryptographic hash of the document, the 
forged commitment, the valid commitment, the signing individual's public key, in the recipient's public key. A valid chal- 
lenge is calculated based on the verifying challenge on the forged challenge. A valid response is calculated based on 
the random factor, the valid challenge, in the signing individual's private key. The method may further include testing the 

25 forged identification transcript by verifying that the forged commitment, the forged challenge, and the forged response 
are consistent. The method may also include testing a valid identification transcript by verifying that the valid commit- 
ment, the valid challenge, and a valid response are consistent, and testing the challenge by verifying that the valid chal- 
lenge and the forged challenge are consistent with the verifying challenge. 

30 BRIEF DESCRIPTION OF THE DRAWINGS 

[0008] 

FIG. 1 is a flowchart illustrating steps that are performed in a method for enabling privacy and trust in electronic 
35 communities in an embodiment of the present invention. 

FIG. 2 is an exemplary identification transcript that is used in an embodiment of the present invention. 

FIG. 3 is a flowchart illustrating steps that are performed for checking consistency in a method for enabling privacy 
40 and trust in electronic communities in an embodiment of the present invention. 

FIG. 4 is a flowchart illustrating steps that are performed in a method for enabling privacy and trust in electronic 
communities in an embodiment of the present invention. 

45 FIG. 5 is a flowchart illustrating steps that are performed in a method for checking consistency of commitments, 
challenges, and responses in a method for enabling privacy and trust in electronic communities in an embodiment 
of the present invention. 

DETAILED DESCRIPTION 

50 

1. Introduction 

[0009] The techniques of the present invention may be used to enhance privacy and trust in electronic communities 
without having to resort to anonymity, pseudonymity, or trusted third parties, through the novel application of existing 
55 cryptographic techniques. In particular, solutions are proposed to the problems of finding shared preferences, discov- 
ering communities with shared values and removing the disincentives posed by liabilities. In addition we propose a 
mechanism that allows an individual to negotiate on behalf of a group by proving membership in that group without 
revealing one's identity. 
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[0010] FIG. 1 shows a flowchart 100 illustrating an embodiment of the present invention. The method described in 
flowchart 1 00 may be used for anonymously establishing a proving individual as a member for group, wherein the prov- 
ing individual has a private key. An identification transcript is forged, step 102, for least one unknown private key, 
wherein the transcript includes at least one forged commitment, at least one forged challenge, and at least one forged 

5 response. An identification transcript is a data structure that may be used by an embodiment of the present invention. 
An example of an identification transcript 202 is shown in FIG. 2, and may contain a commitment 204, a challenge 206, 
and a response 208. A valid commitment is calculated, step 1 04, based on the proving individual's private key. The at 
least one forged commitment and a valid commitment are transmitted to a verifying individual, step 1 06. A verifying 
challenge is received from the verifying individual, step 108, and a valid challenge is calculated based on the at least 

10 one challenge and the verifying challenge, step 1 1 0. A valid response is calculated based on the valid challenge in the 
valid commitment, step 112. The at least one forged challenge, the valid challenge, the at least one forged response, 
and the valid response are then transmitted to the verifying individual, step 1 14. The identification transcript may com- 
prise a commitment, a challenge, and a response from a Schnorr identification protocol. 

[0011] An embodiment of the present invention may also include steps shown in the flowchart 300 of FIG. 3, in 

75 which the forged challenge and the valid challenge are verified to be consistent with the verifying challenge, step 302. 
A consistency check is performed, step 304. If the challenges are not consistent, then processing ends, step 31 0. If the 
challenges are consistent, then processing continues to step 306. The method may also include the step of verifying 
that forged response is consistent with a forged commitment and a forged challenge, step 306. A consistency check is 
performed, step 308, If the forged response is not consistent, then processing ends, step 312. If the forged response is 

20 consistent, then processing continues, step 314. The method may also include the step of verifying that the valid 
response is consistent with the valid commitment and the valid challenge, step 314. A consistency check is then per- 
formed, step 316. If the valid response is not consistent with the valid commitment and the valid challenge, then 
processing ends, step 318. rf the valid response is consistent with the valid commitment and the valid challenge, then 
processing continues, step 320. 

25 [0012] Another embodiment of the present invention, shown by flowchart 400 in FIG. 4, provides a method for a 
signing individual to deniabry sign a document intended for a recipient, wherein the signing individual as a private key 
and public key and the recipient has a public key. An identification transcript is forged for an unknown private key, step 
402, wherein the transcript comprises a forged commitment, a forged challenge, and a forged response. A random fac- 
tor is calculated, step 404, and a valid commitment is calculated based on the random factor, step 406. A verifying chal- 

ao lenge is calculated, step 408. The verifying challenge may be a cryptographic hash of the document, the forged 
commitment, and the valid commitment, the signing individual's public key, or the recipient's public key. A valid chal- 
lenge is calculated based on the verifying challenge and the forged challenge, step 410. A valid response is calculated 
based on the random factor, the valid challenge, in the signing individual's private key, step 412. 
[0013] TTie method may also include steps shown in the flowchart 500 of FIG. 5. A forged identification transcript 

as may be tested by verifying that the forged commitment, the forged challenge, and the forged response are consistent, 
step 502. A consistency check is performed, step 504, and if the forged commitment, the forged challenge, and the 
forged response are not consistent, then processing ends, step 506. If the forged commitment, the forged challenge, 
and the forged response are consistent, then processing continues to step 508, in which valid identification transcript is 
tested by verifying that the valid commitment, the valid challenge, and a valid response are consistent. A consistency 

40 check is performed, step 510. ff the valid commitment, the valid challenge, and the valid response are not consistent, 
then processing ends, step 512. If the valid commitment, the valid challenge, and the valid response are consistent, 
then processing continues to step 51 4. In step 51 4, the challenge is tested by verifying that the valid challenge and the 
forged challenge are consistent with the verifying challenge. A consistency check is performed, step 516. If the valid 
challenge and the forged challenge are not consistent with the verifying challenge, then processing ends, step 51 8. . If 

45 the valid challenge and the forged challenge are consistent with the verifying challenge, then processing continues, 
step 520. 

[0014] The methods shown in FIGs 1 -5 may be performed using a variety of techniques that are discussed in the 
following sections. In section 2, we review the basic cryptographic capabilities required in our discussion. In section 3, 
we introduce a protocol for finding shared preferences and finding communities of similar interests that preserves pri- 

so vacy and also allows for the use of selectivity based on reputations. Moreover, we show how to allow private communi- 
cation among the members of such informal communities by sharing a public key that is issued only to them. Section 4 
uses deniable signatures to remove liabilities in recommendations, while allowing users to discriminate based on their 
view of the recommenders' reputations. Section 5 deals with two issues: proving membership in a community without 
revealing one's identity, and establishing the size of that community without having to list its membership. Section 6 

55 summarizes the findings and discusses the implications of this technology for electronic communities and their self-gov- 
ernance. Cryptographic details for all of our protocols can be found in the Appendix. 
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2. Cryptographic Primitives for Communities 

[0015] The mechanisms we propose rely on a variety of cryptographic techniques, which in turn exploit the use of 
two fundamental cryptographic primitives: hash functions and public key systems. For the benefit of the reader unfamil- 

5 iar with this field we now describe the general properties of these two primitives. 

[0016] In general, cryptographic functions operate on inputs such as ^messages" and „keys\ and produce outputs 
such as „ciphertexts" and ^signatures", it is common to treat all of these inputs and outputs as large integers according 
to some standardized encoding. Throughout this specification, the reader should assume that any value involved in a 
cryptographic function is a large integer, no matter what it may be called. 

10 [0017] A cryptographic hash function, H, is a mathematical transformation that takes a message m of any length, 
and computes from it a short fixed-length message, which we'll call H(m). This fixed length output has the important 
property that there is no way to find what message produced it short of trying all possible messages by trial and error. 
Equally important, even though there may exist many messages that hash to the same value, it is computationally infea- 
sible to find even two values that ^collide". This practically guarantees that the hash of a message can ^represent* the 

is message in a way which is very difficult to cheat An even stronger property that we will require is that the output of a 
cryptographic hash function can-not be easily influenced or predicted ahead of time. Thus someone who wanted to find 
a hash with a particular pattern (beginning with a particular prefix, say) could do no better than trial and error. In prac- 
tice, hash functions such as MD-5 and SHA are often assumed to have these properties. 

[0018] Public key encryption (or signature) rely on a pair of related keys, one secret and one public, associated with 
20 each individual participating in a communication. The secret key is needed to decrypt (or sign), while only the public key 
is needed to encrypt a message (or verify a signature). A public key is generated by those wishing to receive encrypted 
messages, and broadcasted so that it can be used by the sender of the message to encode it The recipient of this mes- 
sage then uses his own private key in combination with his public key to decrypt the message. While slower than secret 
key cryptography, public key systems are preferable when dealing with networks of people that need to be reconfigured 
25 fairly often. Popular public key systems are based on the properties of modular arithmetic. 

3. Shared Preferences and Community Discovery 
3.1. Motivation and Intuition 

30 

[0019] It is often the case that a group of individuals shares a number of preferences while being unaware of the 
existence of each other. While the Internet provides mechanisms for speeding up the process of discovering people 
with similar interests, it does not remove the disincentive inherent in having to disclose private information to unknown 
people while searching for a community that shares a given set of preferences. Consider, for example, the problem of 

35 finding someone from whom to request a recommendation about a particular topic. This can be difficult if one is reluc- 
tant to reveal one's preferences to people who might or might not share them. It would be useful to design a mechanism 
that circumvents this problem. In what follows we present a procedure that allows for a group of individuals to privately 
search for others with similar preferences while keeping their preferences private. Furthermore, this discovery process 
is made operational by producing keys that are available only to members of the group and allow them to communicate 

40 with each other. 

[0020] Another application of this mechanism for community discovery obtains recommendations from users with 
similar interest profiles without contacting them directly. This application can be used in e-commerce situations to rec- 
ommend products likely to be of interest based on the preferences of similar users. By maintaining both privacy and 
selectivity based on reputations, this mechanism allows for precise recommendations. 

45 [0021] Community discovery can also be useful in creating additional services. For instance, as discussed in sec- 
tion 4, it can be useful in distributing pieces of some information among a group of people in such a way that no individ- 
ual can determine the information but the group acting together can do so. Reputations for trustworthiness are an 
important aspect of discovering such groups, and preserving privacy can help encourage people to participate in this 
community service. An example is providing backup storage of private information. 

so [0022] These techniques could be useful not only for users providing information but also for those requesting rec- 
ommendations. Examples include determining the majority opinion in a group without revealing individual preferences, 
or identifying significant but unpopular viewpoints. Furthermore, these protocols allow queries over a set of topics with- 
out revealing the particular question of interest. This could be useful when a sudden shift of interest in particular ques- 
tions or products might change the group behavior in undesirable ways, e.g., causing changes in price levels before an 

55 e-commerce transaction is completed. 
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3.2 Details of our Approach 

[0023] Community Discovery: Our approach to community discovery uses an idea that goes back to work by Bel- 
lare and Mfcali on non-interactive oblivious transfer. M. Bellare and S. Mfcali, „Non-interactive oblivious transfer and 
applications', proc. Crypto '89, 547-557. Anyone can ask a question Q by posting it on a bulletin board. For simplicity, 
assume that Q is a yes/no question, although our techniques generalize to arbitrary multiple-choice questions. We can 
associate an unpredictable random ^challenge" with each question Q in a standard way, by taking the challenge to be 
the hash of Q together with some system-wide public keys. 

[0024] To answer a question Q, create two public keys y 0) y 1 that when multiplied together equals the challenge 
associated with Q. It turns out that it is easy to create these public keys in such a way that the corresponding private 
key is known for one of them. However, it is widely believed to be hard to create the public keys in such a way that the 
corresponding private key is known for both of them. Post on the bulletin board these two public keys y^y^ . An ^answer" 
will be rejected if these keys do not multiply together to the challenge. Otherwise, the answer is accepted, although no 
one can tell how a party has really answered, because that depends on whether the private key for y 0 is actually known 
(in which case the answer was no) or the private key for y A (in which case the answer was yes). There is no need to 
post answers anonymously. In fact, it may be desirable to require answers to be digitally signed, to prevent someone 
from joining both sides of the debate by answering the same question twice. Alternatively, cryptographic pre-registration 
techniques (e.g., using off-line electronic coins as „one-show* credentials) could be used to prevent double answering. 
For a description of electronic cash, see D. Chaum, A. Fiat, and M. Naor, ..Untraceable electronic cash", proc. Crypto 
'88, 319-327. 

[0025] Now anyone can encrypt a message that you can read only if you answered a question in a certain way. Sup- 
pose that A wants to send B a message M, but A only wants B to be able to read it if B answered no to question Q . 
Then A encrypts the message using y 0 as the public key. A can send this message to B directly, or post it to a bulletin 
board, possibly anonymously. If B*s answer was no, then B knows the private key for y^ and thus B can decrypt the 
message. Otherwise, B knows the private key for y^ but not y 0 , and cannot decrypt the message. 
[0026] Community-Wide Conference Key: The mechanism described above is already enough for the community 
to find itself and begin a discussion. It might be desirable to generate a single key that was known to all members of the 
community to facilitate a community-wide discussion. One way to achieve this is to have any member of the community 
choose a secret key and encrypt it so that every other community member can decrypt it For example, if I answered no 
to question Q, then I can choose a random w community-wide conference key* and encrypt it using the „no" public key 
for every answerer. All of these encryptions can be posted anonymously if desired, and signed with a proof of anony- 
mous group membership as described in Section 5. Then everyone in the community (i.e., everyone who answered no 
to question Q) can decrypt to recover the community-wide conference key. It is easy for a new member to join the com- 
munity in an ongoing discussion. This is achieved by posting an encryption of the conference key that the newcomer 
can decrypt only if he has joined the community, together with a signature of anonymous group membership so the 
newcomer knows that the key came from a fellow community member. 

[0027] Private Preference Matching: The community discovery techniques described above could be repeated for 
a number of different questions. Then A could send B a message which B could read only if B answered each question 
a certain way, by encrypting the message so that all of the corresponding keys were necessary to decrypt Another 
approach to multiple shared preferences is to perform a ^secure distributed computation - to find people who answered 
questions in a compatible way. This can be done quite efficiently in the case where compatibility is measured by the 
number of yes/no questions that were answered in common. 

[0028] A basic preference-matching function takes as input two lists of yes/no answers and a threshold. It outputs 
„true B if the number of answers where the two fists match is at or above the threshold. The one-against-many variant 
takes as input a „query" answer list, a ^database" of answer lists, and a threshold, ft outputs pointers to all answer lists 
in the database that have a sufficiently large match with the query list. The many-against-many variant is similar, except 
there are two database lists, or a single list compared against itself. 

[0029] There are a number of techniques in the cryptographic literature for two or more parties to compute these 
kind of preference matching functions, under a wide variety of assumptions about the fault model, the amount of infor- 
mation leakage, the communication model, and so forth (surveyed in M. Franklin and M. Yung, „ Varieties of secure dis- 
tributed computing", proc. Sequences II Workshop, 1 991). In the Appendix, we present one technique that is somewhat 
easier to describe, and quite efficient Note that this scheme leaks a small amount of additional information, i.e., the 
number of matches in two preference lists rather than the one-bit decision about whether the number of matches 
exceeds some threshold. This is not an inherent limitation, it is a design trade-off to achieve greater efficiency. 
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4. Removing Liability 

4.1 Motivation and Intuition 

5 [0030] Rnding someone satisfying a number of shared preferences is not enough in order to obtain a valuable rec- 
ommendation. A potential recommender might be concerned about the liability that would result if the recommendation 
turned out to be of negative value to the requester. This is a concern for a number of communities, including malprac- 
tice-sensitive doctors, financial advisors, or even members of a recommendation system such as Xerox's Knowledge 
Pump (see Glance, Arregui, and Dardenne, referenced above). While anonymity might address this problem, it then 

10 generates another one, which has to do with the lack of a reputation that could be built over time. Pseudonyms allow 
reputations to be built over time, but they are ^brittle" in the sense that uncovering the author of any message would 
establish the authorship of all messages with that pseudonym. Another possible approach is a contract in which the par- 
ties explicitly agree to waive liability, but this may be cumbersome and costly to devise, especially when multiple juris- 
dictions are involved. 

is [0031 ] We propose the use of ^deniable signatures" to allow reputations and limited associations without fear of lia- 
bility. With a deniable signature, the recipient of a recommendation knows it came from a person with an appropriate 
reputation, but cannot prove that connection to anyone else. 

[0032] A further enhancement can give deniable signatures that are ^convertible". The signer keeps an additional 
secret for each signed message which, when revealed, converts a deniable signature into an ^ordinary" signature that 
20 is clearly and convincingly connected to the signer. This could give the recommender the flexibility to avoid liability as a 
default, while maintaining the ability to prove authorship if necessary. A further enhancement can distribute the conver- 
sion mechanism among many parties, to prevent the signer from being coerced to convert a deniable signature against 
his will. 

25 4.2 Our Approach 

[0033] Deniable signatures have been the focus of much attention in the cryptographic literature in recent years. In 
what follows, we describe one particularly efficient approach to deniable signatures that relies on ideas from Cramer, 
Damgaard and Schoenmakers (R. Cramer, I. Damgaard and B. Schoenmakers, ^Proofs of partial knowledge and sim- 

X plified design of witness hiding protocols', proc. Crypto '94, 1 74-1 87) and Jakobsson, Sako and Impagliazzo (M. Jakob- 
sson, K. Sako and R. Impagliazzo, ^Designated verifier proofs and their applications", proc. Eurocrypt '96, 143-154). It 
relies on a technique to prove knowledge of one out of two secret keys without revealing which is known. 
[0034] To begin, we describe a generic kind of three-round proof of knowledge. The Schnorr protocol is an example 
that fits the model we describe. C. Schnorr, ^Efficient signature generation by smart cards", Journal of Cryptology 4 

35 (1991), 161-1 74. The prover knows a secret key that corresponds to a given public key. To authenticate himself to a ver- 
ifier, the prover wishes to demonstrate knowledge of the secret key. They proceed as follows: 

1 . Prover ? Verifier cryptographic commitment based on p rover's secret key; 

40 2. Verifier ? Prover: random challenge based on verifier's random coin flips; 

3. Prover ? Verifier: consistent response to challenge; 

4. Verifier accepts if response is consistent with commitment, challenge, and prover's public key. This is convincing 
45 to the verifier because it would have been very difficult for the prover to compute a consistent response without 

knowing the secret key. 

[0035] To create a one-out-of-two proof of knowledge, another trick is needed. Many of these three-round proofs of 
knowledge (including the Schnorr protocol) have the remarkable property that it is very easy to forge transcripts - w'tth- 
50 out knowing the secret key. The forger works backwards, starting with a (third-round) random response, and then 
choosing a (second-round) random challenge. Given these, it easy to compute a (first-round) commitment that will com- 
plete a valid transcript (Of course, this doesn't contradict the security of the proof of knowledge, since there is a big 
difference between being able to forge a transcript by working backwards, and being able to fool a verifier in real-time 
going forwards.) 

55 [0036] For the one-out-of-two proof of knowledge, the Prover forges a transcript ahead of time for the secret key 
that he does not know. Then the protocol is as follows: 

1 . Prover ? Verifier: commitment! , commitment^ 
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2. Verifier ? Prover: challenge (only onel); 

3. Prover ? Verifier: challenge^ response^ challenge response2 such that challenge 1 + challenge2 = challenge; 
5 4. Verifier tests the following: 

(a) consistency of commitment), challenge^ response^ public key^ 

(b) consistency of commitment, chaJlenge2, response 2l public key 2 ; 

10 

(c) challenge = challenge 1 + challenge 2 . 

[0037] The intuition behind this protocol is that the Prover is free to split the Verifier's challenge so that one of the 
pieces matches the pre-forged transcript This leaves the Prover to respond to the other piece of the challenge, which 
75 he can do because he knows that secret key. if the Prover knows neither secret key, then it is very unlikely that the Ver- 
ifier's challenge can be split to match two pre-forged transcripts. 

[0038] These interactive protocols can be converted into non-interactive signature schemes by using the Rat- 
Shamir heuristic. U. Feige, A. Rat and A. Shamir, „Zero-knowledge proofs of identity 4 ', Journal of Cryptology 1 (1988), 
77-94. The idea is that the signer plays the role of the Prover, but computes the Verifier's challenge himself using a cryp- 
20 tographically strong hash function such as MD5 or SHA. The signer applies the hash function to the message to be 
signed, the public key(s), and the commitment(s) ^sent" in the first round. 

[0039] Now we can describe the deniable signature scheme at an intuitive level (see Appendix for details). Sign a 
message using the non-interactive version of a one-out-of-two proof of knowledge, where the two public keys belong to 
the signer and the receiver. That is, the signer is proving knowledge of either his own private key or the receiver's private 
25 key. This signature could only have been produced by the signer or the receiver, and thus it is completely convincing to 
the receiver (by process of elimination!). However, no third party can tell whether the signer or the receiver has created 
this signature, and so the signer has deniabil'rty. 

[0040] R>r convertibility, the signer takes advantage of the freedom that he has in generating the forged transcript. 
Instead of beginning his forgery with a random third-round response, the forger computes this value as the output of a 
30 cryptographic hash function. Revealing the input to the hash function would be convincing evidence as to which part of 
the transcript was forged, and thus which secret key must have been known to the signer. It is easy to distribute the con- 
version function among many parties, by using a sum of hash outputs instead of a single hash output to compute the 
forged response, where each party knows only one of the hash inputs. 

35 5. Proving Membership In a Group 

5.1 Motivation and Intuition 

[0041] It is often the case that membership in a particular group or community can be valuable for establishing 
40 one's credentials, reputation or even for negotiating with another group or firm on behalf on one's group. And yet, there 
are many situations when one might desire to remain anonymous in case the group that one belongs to has an image 
or value that could be negative to the firm. RnaJly, group membership could be established without revealing the partic- 
ular individual identity, which could be used as authorization or capability for some transaction or to negotiate with a firm 
or individual on behalf of the whole group. 
45 [0042] There are a number of schemes in the cryptographic literature that can be used to solve these problems. We 
show one such scheme by adapting the approach from the previous section. One drawback of what we present here is 
that the effort involved (and the size of the messages) is proportional to the size of the group. It may be desirable to hide 
one's identity within a smaller group, giving up a degree of anonymity for greater efficiency. 

so 52 Approach 

[0043] The deniable signature scheme from the previous section relied on a kind of a one-out-of-two" proof of knowl- 
edge. The message signer proved that he knew either his own private key or the recipient's private key. This technique 
generalizes easily to a 1-out-of-n proof of knowledge, which is useful for anonymously proving membership in a group. 
55 It also generalizes to a r-out-of-n proof of knowledge, which is useful for anonymously demonstrating negotiating power. 
These generalizations can be realized as either an interactive identification protocol or a non-interactive signature 
scheme. We describe both of these generalizations following. See Cramer, Damgaard, and Schoenmakers, referenced 
above. 
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[0044] For a 1 -out-of-n proof of knowledge, the prover begins by forging the Schnorr transcript for the n - 1 private 
keys that he does not know. Then the protocol is as follows: 

1 . Prover ? Verifier: commitment! commitment,,; 

5 

2. Verifier ? Prover: challenge (onty one!); 

3. Prover ? Verifier challenge*,, response! challenges,,, response,, such that challenge! + ... + challenge,, = 

challenge; 

10 

4. Verifier tests the following: 

(a) consistency of commitment^ challenge/, response/, public key/ for every /, 1 2 / 2 n\ 

is (b) challenge challenge! + ... + challenge,,. 

[0045] The intuition is as in the one-out-of-two case. The prover has the freedom to choose all but one of the chal- 
lenges, and can use his knowledge of the secret key to respond to the one challenge he cannot control. The Verifier 
cannot tell which transcripts were forged ahead of time. 

20 [0046] For proving knowledge of f-out-of-/? private keys, everything is the same as before except for the relationship 
of challenge, challenge!, — . challenge^ There must be a degree n - 1 polynomial f(x) such that f(i) = challenge, for 
every /, 1 2 / 2 n, and such that f(0) = challenge. The intuition is that the Prover can forge transcripts ahead of time for 
the n - 1 private keys that he does not know, and then interpolate to find f{x) (uniquely determined) from those chal- 
lenges together with the challenge from the verifier. 

25 [0047] Signature versions of both of these protocols can be derived by using the Rat-Shamir heuristic as before. 
More details of the cryptographic schemes described in this section can be found in the Appendix. 
[0048] The signature version of the 1 -out-of-n proof of knowledge is useful for distributing community-wide confer- 
ence keys as discussed in Section 3. Say that I have created a conference key for everyone who answered yes to ques- 
tion Q. I randomly choose an additional n - 1 parties who answered question Q, without knowing how they answered. 

30 Then I can prove knowledge of one of the private keys corresponding to the set of n „yes" public keys. By choosing a 
suitably large n t my identity is hidden well. By signing the encrypted conference keys in this way, anyone who success- 
fully decrypts the conference key will have the added assurance that it was created by a fellow member of the commu- 
nity. 

[0049] There are variations on these ideas in the cryptographic literature that allow for ^identity escrow". This 
35 means that the true identity of the prover or signer might be recoverable under exceptional circumstances (e.g., with a 
search warrant). Relatively efficient implementations can be found in J. Gamenisch and M. Stadler, Efficient group sig- 
natures schemes for large groups", Proc. Crypto '97, 410-424; and J. Kilian and E. Petrank, ^Identity Escrow", Proc. 
Crypto *98, 1 69-1 85. These schemes also scale well as the size of the group increases, which is not the case for the 
simpler schemes described in this section. 

40 

6. Discussion 

[0050] In this specification, a number of new techniques for finding members of groups sharing similar preferences 
and obtaining their recommendations in ways that protect privacy while also allowing reputations to be built and 

45 updated have been introduced. Moreover, these mechanisms do not require the creation of trusted third parties and 
their attendant problems. Reputations are extremely valuable in the context of electronic commerce, for when authen- 
ticated they provide a mechanism for trust to established, thus circumventing a number of costly transactions. F. Fuku- 
yama, „Trust the social virtues and the creation of prosperity", Free Press (1 996). Trust is an important component of 
an efficient market, since fake postings of particular messages can lead to inefficient allocation of resources. Witness 

so the recent posting of a bogus Bloomberg financial news story, which sent shares of a small technology company soar- 
ing 31 percent in one day, only to fall to previous values when the story proved false. The New York Times, April 8, 1 999. 
[0051] Another application we designed consists in the removal of the disincentive associated with the liability 
implied in issuing recommendations, thus making recommender systems more effective. Finally, we showed how indi- 
viduals can prove membership in groups without revealing their identity, thus paving the way for negotiations between 

55 groups that seek to remain anonymous and firms that could profit from dealing with them. 

[0052] These mechanisms involve trade-offs among computational efficiency, the leaking of information and ease 
of use. These trade-offs can be resolved differently depending on the specific application. For example, one may want 
to make it easier for new people to join a community by towering the number of passwords and preferences that need 
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to be listed, at the expense of reduced privacy. Another instance would be one in which everybody in a group shares 
the same key which is a simple and secure procedure as long as no one leaves the group. 

[0053] Additional trade-offs appear when one considers spoofing, whereby people can present false preferences in 
order to gain access to privileged information or to deter others from gaining an advantage from a weak adversary. One 
response might be anonymity, but at the cost of losing the benefit of reputation building. Another one could be analo- 
gous to biological situations, where false signaling is used by many organisms to deter attack or to gain access to val- 
uable resources. A strategy that has evolved to address the problem of spoofing in that context is for signals themselves 
to be costly to produce, and thus to imitate. A. Zahavi and A. Zahavi, „The Handicap Principle: A Missing Piece of Dar- 
win's Puzzle", Oxford Univ. Press (1997). Similar strategies could be applied to electronic communities by increasing 
the number of challenges needed to access a given group, or by imposing a waiting period. On the other hand, this 
could deter legitimate new people from joining the group. Moreover, even if the trade-offs could be negotiated success- 
fully, there remains the problem of misusing these techniques, as in the case of fraudulent financial transactions, insider 
trading or the unauthorized collection of personal data. 

[0054] In spite of the great potential for electronic commerce that the Web is enabling through its global reach, there 
are vast areas of knowledge and expertise that remain untapped for lack of mechanisms that ensure privacy and trust. 
The techniques that we proposed make it easier to access vast repositories of information that are not readily known to 
producers and consumers, thus leading to improvements in economic efficiency though the more focused use of 
resources. 



Appendix: Cryptographic Details 

Discrete Log Problem: Let p be a large prime, and let q be a large prime factor of p - 
1. Let g be an element of order q modulo p. That is, g y g 1 , are all distinct elements 
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modulo p, and = I mod p. It is widely believed that the „discrete log u problem is hard in this 
setting: Given g, p, y, find x such that g -y mod p. 

Discrete Log Based Community Discovery: The values p and g are system-wide pa* 
rameters. The challenge associated with question Q is the cryptographic hash of Q, p 9 and g. 
To answer the question Q with b - 0 or b = I, choose a random x between 1 and q y and com- 
pute yt, = £ mod p. Then compute yu> = cly b mod p. Then post on the bulletin board an 
„answer" (yoji). Ifytyi mod p is not equal to c, then the answer is considered to be invalid, 
and it is ignored. Otherwise, the answer is accepted. If the answer is accepted, then it is ex- 
tremely unlikely that the answering party could know the discrete log of both y 0 and y x . If 
someone encrypts a message using one ofyb or>t as the public key, a party will be able to de- 
crypt it only if he knows the corresponding private key. 

One example of a discrete log based public key encryption scheme that can be used is 
due to ElGamal. T. ElGamal, „A public key cryptosystem and a signature scheme based on 
discrete logarithms," IEEE Transactions on Information Theory 31 (1985), 469-472. In the 
ElGamal public key encryption scheme, the public key for a user is some g t p, y, and the corre- 
sponding private key is the discrete log x such that g =y mod p. The encryption of message m 
is (gf mod p\ m/ mod p\ where r is chosen randomly by the encryptor. Given a dphertext 
the decryptor computes v/j/ mod p = m. Without knowing x, it is believed to be hard to 
decrypt ciphertexts (by an assumption related to the hardness of the discrete log problem). 

Xor-Homomorphic Encryption based on Quadratic Residnostty Encryption (see 
S. Goldwasser and S. Micali, ^Probabilistic public key encryption,* 4 Journal of Computer and 
System Sciences 28 (1984), 270-299): Letp, q be two large primes such that p ? q ? 3 mod 4. 
Let N = pq. Let QR = {r2 mod N : gcd(r^V) = 1 } and let NQR = {-r 2 mod N : gcd(r^V) = 1 } . 
These two sets are disjoint. Given a random element from one of the two sets, and given the 
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factorization of N, there is an efficient procedure to determine which set it came from. Without 
knowing the factorization of N t it is widely believed to be hard to tell which set a random ele- 
ment came from. To encrypt bit b, choose a random r such that gcd(r,N) = 1 and compute 
E(b) - (- l)V mod N. To decrypt an encrypted bit c, use the factorization of AT to determine if 
c is in QR or NQR. D{c) = 0 if c is in QR, and D(c) = 1 if c is in NQR. This encryption 
scheme is xor-homomorphic because E{b\)E{bi) mod N is an encryption of b\ © bi. 

Private Preference Matching: Here is a protocol for Alice and Bob to evaluate the 
basic preference-matching function using any xor-homomorphic encryption scheme. Alice and 
Bob each encrypt their answers to the survey bit-by-bit using Alice's public key. Alice sends 
her encrypted answers (c u .... c») to Bob. Bob computes encryptions of the xor's of their two 
answer lists, and returns these encryptions to Alice in a random order. When Alice decrypts, 
the number of zeroes tells her the number of times their answers matched (and nothing more). 

A related approach can evaluate the many-against-many version and other variants. 
Each participant encrypts his answers to the survey using the same system-wide public key. 
These encrypted answers are stored in the system database. To find if two participants have 
similar preferences, the database computes encryptions of the bitwise xors of their answers, 
and then send these encryptions (in a random order) to a separate entity that knows the sys- 
tem-wide private key. This separate entity can decrypt and count the number of zeroes, and 
then report back whether there was a high match or not. 

Schnorr Public Key Signature Scheme: In the Schnorr public key signature scheme, 
the public key for a user is some gj>y 9 and the corresponding private key is the discrete log x 
such that g -y mod p. The signature of message m \s(gf mod p, c, r+cx mod q) y where r is 
chosen randomly by the signer, and where c is random but not chosen by the signer. One way 
to get c is to compute c = //(g, p % y, m, g mod p) for some cryptographically strong hash 
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function (eg., MD-5 or SHA). To verify that (z,c,u) is a signature of m with respect to public 
key gj>y y the verifier confirms that z/ ?g" modp and that c = H(g y p,y, m y z). 

Deniable Schnorr Signature: Suppose that party / wants to deniably sign a message m 
to party / The deniable signature will be z h c*, u h z h c Jt i/„ where [z h c ly u t ] is a valid Schnorr 
identification transcript for prover i, and where [z h c h u f ] is a valid Schnorr identification tran- 
script for prover j\ and where c, + c, = H(m> z h z h y it y h p, g). Party / proceeds as follows: 

1. Forge a transcript [z Jy c h «,] of a Schnorr identification protocol for prover j 9 by choosing 
random u h c t e [I . . q] and computing Zj ^fplyp mod p\ 

2. Choose a random r t e [1 . . .q] and compute z t = mod p. (to „begin" the id protocol for 
prover #.); 

3. Compute c = Him, z h z h y h y h p, g\ and let c, * c - c, mod & 

4. Compute u t = n + cp, mod q. (To ^complete" the id protocol for prover /.). 

A deniable signature is valid if the two identification transcripts are valid, and if the 
challenges add up to the hash output as indicated. This signature could only be efficiently com- 
puted by someone who knows the private key of party / or party j. That is why it is convincing 
to party j when he receives it, and why it is deniable by party i afterwards. 

Anonymous Group Membership: For notational convenience, assume the group is 
parties 1 through n y and the prover is party 1. The prover begins by forging Schnorr transcripts 
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[*2, ci, «*], .... [** c* i/a] for the private keys he does not know. The protocol proceeds as 
follows: 

1. Prover (party I) ? Verifier: 

z\, * * * where z\ — tf x mod for a random ri 6 [I . . . q\ f 

2. Verifier ? Prover: c random in [1 . . ,q]\ 

3. Prover ? Verifier (ci,v !),...,(£*"«) such that c = c% + ... + c„ mod g and such that v x = ^ 
+ cpri mod 

4. Verifier accepts =g*mod/* for all/, 1 2 / 2 /?, and ifc = Ci + ... + c,mod?. 

For the signature version of anonymous group membership, the signer computes his 
own challenge c = H(m 9 zi, z^yu ,y*p, g) where /f is a cryptographically strong hash 
function and m is the message to be signed. 

Anonymous Group Power: For notational convenience, assume the group is parties 1 
through n, and the prover knows the private keys of parties 1, t. The prover begins by 
forging Schnorr transcripts \z^u c m, Mr*i], [z m c nt uj for the private keys he does not 
know. The protocol proceeds as follows: 

1. Prover? Verifier ri,...^ where z\ = g ri mod/? for a random r x € [l.q] for every /, 1 2 

2. Verifier ? Prover: c e [1...?]; 
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3. Prover ? Verifier: (Ci,U|) ( . . . ,(c„ u n ) such that a, = n + c>r, mod q for every /, 1 2 j 2 /, and 
such that c, mod q for the unique polynomial / of degree at most n - / satisfying,/^) 
= c mod qr and /[/) = cj mod g for all y, ^1 a y 2 /?; 



4. Verifier accepts if zyf % - g* mod p for all /, 1 2 / 2 *i, and if there is a polynomial / of de- 
gree at most n-t such that^O) = c mod q vnAflj) - c, mod q for all i, 1 2 / 2 n. 



For the signature version of anonymous group power, the signer computes his own 
challenge c = H(m 9 z u ...>z*,yi, ...y»,p, g) where H is a cryptographically strong hash func- 
tion and m is the message to be signed. 

It should be appreciated that the description herein is merely illustrative; and should not 
be read to limit the scope of the invention nor the claims hereof. 



Claims 

1 . A method for anonymously establishing a proving individual as a member of a group for purposes of establishing a 
community recommendation without liability, wherein the proving individual has a private key, comprising the steps 
of: 

forgng an identification transcript for at least one unknown private key, wherein the transcript comprises at 
least one forged commitment, at least one forged challenge, and at least one forged response; 
calculating a valid commitment based on the proving individual's private key; 
transmitting the at least one forged commitment and the valid commitment to a verifying individual; 
receiving a verifying challenge from the verifying individual; 

calculating a valid challenge based on the at least one forged challenge and the verifying challenge; 
calculating a valid response based on the valid challenge and the valid commitment; 
transmitting the at least one forged challenge, the valid challenge, the at least one forged response, and the 
valid response to the verifying individual; 

verifying that the at least one forged challenge and the valid challenge are consistent with the verifying chal- 
lenge; 

verifying that the at least one forged response is consistent with the at least one forged commitment and the at 
least one forged challenge; and 

verifying that the valid response is consistent with the valid commitment and the valid challenge. 

2. The method of claim 1 , wherein the identification transcript comprises a commitment, a challenge, and a response 
from a Schnorr identification protocol. 

3. The method of claim 1 , wherein: 

the transcript comprises a plurality of forged commitments, a plurality of forged challenges, and a plurality of 
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forged responses; 

A method for a signing individual to deniably sign a document intended for a recipient for purposes of making rec- 
ommendations without liability, wherein the signing individual has a private key and a public key and the recipient 
has a public key, comprising the steps of: 

forging an identification transcript for an unknown private key, wherein the transcript comprises a forged com- 
mitment, a forged challenge, and a forged response; 

calculating a random factor; 

calculating a valid commitment based on the random factor; 

calculating a verifying challenge as a cryptographic hash of the document, the forged commitment, the valid 
commitment, the signing individual's public key, and the recipient's public key; 

calculating a valid challenge based on the verifying challenge and the forged challenge; 

calculating a valid response based on the random factor, the valid challenge, and the signing individual's pri- 
vate key. 

The method of daim 4, further comprising the steps of: 

testing the forged identification transcript by verifying that the forged commitment, the forged challenge, and 
the forged response are consistent; 

testing a valid identification transcript by verifying that the valid commitment, the valid challenge, and the valid 
response are consistent; and 

testing the challenge by verifying that the valid challenge and the forge challenge are consistent with the veri- 
fying challenge. 

A method for discovering communities, comprising the steps of: 

posting a question on a bulletin board, wherein the question is posted by a community organizer; 

answering a question, wherein the question is answered by a community joiner; 

creating a challenge by multiplying at least two public keys; 

rejecting the answer if the keys do not multiply together to the challenge; and 

accepting the answer if the keys do multiply to the challenge. 
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